Privacy policy

This is an English translation of our Thai privacy policy, provided for your convenience. If the two differ, the Thai version prevails.

Kintury Energy Company Limited (บริษัท คินทูรี่ เอ็นเนอร์ยี่ จำกัด) ("the Company" or "we"), as data controller, publishes this policy to tell you how we collect, use, disclose and look after your personal data under the Personal Data Protection Act B.E. 2562 (2019) and related laws ("the data protection law"). By using the website, sending a form or contacting the Company, you acknowledge this policy.

1. Scope

• This policy covers personal data the Company receives through www.kintury.com and kinturyenergy.com ("the website"), the forms on the website, the LINE Official Account @kintury, and the telephone numbers and email addresses shown on the website.
• It does not cover websites, apps or services of third parties, even when the website links to them, such as LINE, Facebook and Google Maps, which have their own policies. The Company has no control over, and is not responsible for, how those third parties collect, use or disclose data.
• If you enter into a contract with the Company, such as an installation contract or a power purchase agreement, the data terms of that contract apply together with this policy. Where they conflict, the contract prevails.

2. The personal data we collect

2.1 Data you give us

• Applications for programmes, training courses or events: full name, phone number, email, LINE ID, company or organisation, province, district, answers to the questions each programme asks, and your message to the team.
• The form to express interest in an installation or ask for advice: company name, type of business, monthly electricity bill range, billing period, province, district, contact name, phone number, how you heard of us and the system size you are interested in.
• Status checks: the phone number you enter to look up your record.
• Contact by LINE, telephone or email: the messages, pictures and documents you send, such as an electricity bill (which may show a name, an address, an electricity account number and consumption), and the LINE account details LINE shares with the Company, such as your display name and profile picture.
• Site surveys and services: location details, photos of the roof or installation area, and electricity usage data received while surveying, designing, quoting, installing and maintaining a system.

2.2 Data collected automatically

• Technical data when an application is sent: IP address, browser and device details (User-Agent), date and time, and the page you came from, for security, to prevent duplicate or abusive submissions, and as a record of the application.
• Website statistics and cookies: see section 8.
• Server access logs: containing IP addresses and the pages requested, kept for a short time for system security.

2.3 Data received from others

The Company may receive your data from someone who applies or makes contact on your behalf, such as an organisation's coordinator who sends a list of staff, or a person who refers you to us. That person has the duties in section 9.

2.4 Sensitive personal data

The Company does not intend to collect sensitive data, such as race, political opinions, religious beliefs, health data, criminal records or biometric data. Please do not send such data unless it is needed. If a programme needs it, for example food allergies for catering at an event, the form will say so. Giving it is voluntary, and filling it in and sending the form is explicit consent to its use for that purpose only.

2.5 What we do not collect

• The figures you enter in the solar calculator, which are worked out entirely in your browser and never sent to the Company.
• What you type in a form before you send it.
• Data from advertising pixels, marketing cookies or third-party analytics tools: the website does not use them.

3. Purposes and lawful bases

If you do not provide the data that is needed, the Company may be unable to consider your application, call you back or serve you. If the Company wishes to use data for a new purpose unrelated to the above, it will tell you and ask for consent where the law requires.

4. Disclosure of personal data

The Company does not sell personal data. It may disclose data, as far as necessary for the purposes in section 3, to:

• service providers working for or supporting the Company, such as providers of IT, server, email and communication systems, contractors, technicians and site surveyors, advisers and auditors, under a duty of confidentiality;
• co-organisers, speakers, venues and partners of the programme you apply for, limited to the data needed to run that programme;
• affiliated or related companies, for the purposes in this policy;
• a buyer, transferee or merger party in a restructuring, merger or transfer of the business;
• government authorities, courts or other persons with legal authority, or where needed to protect the rights, property or safety of the Company, its customers or others.

Joining a programme's LINE group is voluntary. Other members of the group will see your display name, profile picture and the messages you post, as LINE works and is set up, which is outside the Company's control.

5. Transfers outside Thailand

Some data may be sent to or stored on the systems of service providers located outside Thailand, such as communication services (LINE) and providers of web fonts or page libraries. The Company will act in line with sections 28 and 29 of the data protection law, for example where the destination has adequate protection, appropriate safeguards are in place, or an exemption under the law applies.

6. How long we keep data

• Applications, customer and enquiry records and correspondence: for as long as needed for the purposes, and for up to 10 years after the last contact or relationship, in line with the general prescription period of the Civil and Commercial Code, or longer if the law requires or there is a dispute.
• Accounting and tax records: for the periods the law requires.
• Records of consent given or withdrawn: for as long as needed to show compliance with the law.
• Website statistics: kept to follow long-term trends and not deleted on a schedule. Statistics counted anonymously cannot be traced back to you. The link between your visits and a form you sent (where your browser was remembered) is removed when you ask.
• Server access logs: for a short time, as the system rotates them.

After these periods, the Company deletes or destroys the data, or makes it impossible to identify you.

7. Your rights

Subject to the conditions of the data protection law, you have the right to:

• withdraw consent you have given;
• access your data and obtain a copy, and ask how we obtained data you did not consent to;
• receive your data, or have it sent or transferred, in a machine-readable format;
• object to the collection, use or disclosure of your data;
• have your data deleted, destroyed or made impossible to identify you;
• have the use of your data restricted;
• have your data corrected so that it is accurate, up to date, complete and not misleading;
• complain to the Office of the Personal Data Protection Committee.

You can exercise these rights by contacting us as in section 13. The Company may ask for proof of identity before acting, and will consider your request and reply within 30 days of receiving a complete request, or within the period the law sets.

The Company may refuse a request, or carry it out only in part, where the law allows, for example where the data must be kept by law, is needed to establish, exercise or defend legal claims, or where acting on the request would affect the rights of others; it will tell you why. Withdrawing consent does not affect what was done before the withdrawal, and may mean the Company can no longer provide some services to you. For requests that are unfounded, repetitive or excessive, the Company may refuse or charge a reasonable fee, as far as the law allows.

8. Cookies and website statistics

The full list of cookies the website uses, how long they last, and the buttons to accept or decline statistics cookies are in the cookies section of the website terms of use.

• The Company uses its own statistics system, and the data stays in the Company's own system. We use no third-party analytics tools, no advertising pixels and no marketing cookies.
• The statistics system records the pages you open, the time spent on each page, how far you scroll, the website or app that brought you here, your type of device, browser, operating system and the language set on it, clicks on links and buttons (only the text on the button and the page the link leads to), starting or sending a form, your screen size, your device's time zone (which tells us the country roughly, instead of your IP address) and errors that occur on the page in your browser. If a form cannot be sent, only the names of the fields that need correcting are recorded, never what you typed. Visits by automated programs (bots) are kept apart and are not counted in the statistics.
• Using the website means accepting cookies under the website terms of use: the website shows no cookie consent bar. From the first page you open, the Company sets the kt_vid cookie, which holds a random code for 13 months from your latest visit, to recognise that this browser has visited before; when you send an application or a form, the Company links this browser's visits to this website with what you sent, to improve its communication and services.
• You can decline at any time with the "Decline statistics cookies" button in the cookies section of the terms of use (the "Cookie settings" link at the bottom of the page leads there). If you decline, the Company deletes the kt_vid cookie and counts your visits anonymously only, using a daily code calculated from your IP address and browser details together with a random value that is deleted within 2 days. The Company does not record your IP address in the statistics, and does not link the statistics to any form you send. Your choice is kept in the kt_consent cookie for 13 months.
• If your browser signals that it does not want to be tracked (Do Not Track or Global Privacy Control), the Company does not remember your browser and counts your visits anonymously only, unless you press accept yourself.
• The language cookie (locale) lasts 1 year, is set only when you choose the website's language, and holds only the language code.
• Cookies the website needs to work, such as the session cookie and the cookie that protects against forged requests (XSRF-TOKEN), cannot be switched off.
• Pages load fonts and libraries from Google Fonts, jsDelivr and cdnjs. These providers may receive your IP address and browser details as a normal part of delivering the files, under their own policies.
• You can delete or block cookies in your browser settings, but parts of the website may not work fully, and if you delete all of this website's cookies, your decision to decline is deleted too.

9. Your duties when you give us data

• You must give accurate, complete and up-to-date data, and tell the Company when it changes.
• If you give us data about other people, such as staff of your organisation, contacts or fellow participants, you confirm that you have told them about this policy and have their consent or another lawful basis to give that data to the Company.
• You are responsible, as the law provides, for damage caused by giving false data or giving other people's data without the right to do so.

10. Minors

The website and services are intended for persons who have reached the age of majority and for legal entities. A minor who wishes to apply or send data must have the consent of the person exercising parental power, as the law requires. If the Company learns that it has received a minor's data without such consent, it may refuse the application or request and deal with the data as the law requires.

11. Security

• The Company uses appropriate organisational and technical measures, such as encrypted connections (HTTPS), access to the back office limited by role, a history of how each record was handled, and hashed passwords.
• Employees and service providers have access only to the data their work needs, under a duty of confidentiality.
• If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee and you as the law requires.
• No method of sending or storing data electronically is completely secure. To the extent the law allows, the Company is not liable for damage caused by events beyond its reasonable control, such as unauthorised access by third parties despite appropriate measures, or faults in your own devices, accounts or networks.

12. Changes to this policy

The Company may update this policy from time to time. The latest version is shown on this page with its date and takes effect when published. For significant changes, the Company will announce them on the website and ask for consent again where the law requires. Continuing to use the website after a change means you acknowledge the new version.

13. Contact

14. Governing law

This policy is governed by and interpreted under Thai law, and disputes about it fall under the jurisdiction of the Thai courts. The Thai version is the original; if a translation differs from it, the Thai version prevails.